Supply Chain
What is a SaaSBOM and should you ask SaaS vendors for one?
A SaaSBOM inventories a service's endpoints, dependencies and data flows. Here is what it covers, how it differs from an SBOM, and when to ask for one.
Oct 18, 20263 min read
Resources
Supply Chain Security, in plain English.
Deep dives, practical guides, and incident analyses from engineers who build Safeguard. No fluff, no vendor FUD — just what you need to ship secure software.
Filter
Articles
RSS feedSupply Chain
What is a SaaSBOM and does it belong in your service inventory?
A SaaSBOM lists the services in a system and the data that flows between them. See how it differs from an SBOM and when it helps vulnerability work.
Oct 18, 20263 min read
Supply Chain
What is a reproducible build, and does your desktop app need one?
A reproducible build lets anyone rebuild the same source and get bit for bit identical output. What it proves, what it costs and how to start.
Oct 18, 20263 min read
Supply Chain
What is a DSSE envelope and why do attestations use it?
DSSE is the signing envelope behind in-toto and Sigstore attestations. Learn the fields, the pre-authentication encoding and the one rule to follow.
Oct 18, 20263 min read
Supply Chain
What do you do when two VEX statements about one flaw conflict?
When a supplier and a third party disagree on a VEX status, compare author, date, scope and evidence, then record your decision. A clear procedure.
Oct 18, 20263 min read
Supply Chain
What happens if Fulcio or an OIDC provider is compromised?
Sigstore's security model: a compromised identity provider or CA could mint bad certificates, but they must be logged to be trusted. What monitoring adds.
Oct 18, 20263 min read
Supply Chain
What happens to your Go build if a dependency repository is deleted?
Go's module mirror caches versions and the checksum database fixes contents, but only vendoring or your own proxy guarantees a build. Options compared.
Oct 18, 20263 min read
Supply Chain
What does helm install verify actually prove about a chart?
Helm verify proves the chart file matches a signed checksum from a key you trust. It does not prove the chart is safe. Here is how it works.
Oct 18, 20263 min read
Supply Chain
What happens when a WordPress plugin is closed for security issues?
A plugin closed in the WordPress directory can no longer be downloaded, but it stays on your store. What closure means and what to do about it.
Oct 18, 20263 min read
Stay informed
Weekly insights on software supply chain security, delivered to your inbox.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.